Meta has paid roughly $1.2 million for vulnerability reports affecting its Muse AI agent, including $300,000 for a flaw that exposed conversations and tokens on internal test systems before launch. SecurityWeek reported that the findings also included attacks involving malicious web pages, email passcodes and Muse’s desktop and mobile apps.
Muse acts on users’ behalf across email, calendars, messaging and other accounts, with each user’s agent running in its own virtual machine—a separate software-based computer. The disclosed findings concern several different ways attackers could cross those access boundaries, with conditions ranging from asking Muse to summarize a malicious page to an attacker already having access to a Mac.
Meta’s David Singleton said in a blog post cited by SecurityWeek that the bounty program began privately in April and opened publicly when Muse launched on September 8. Researchers submitted more than 630 reports, of which 64 were valid.
A proxy change broke a trust check
The largest disclosed reward, $300,000, was awarded four months before launch, during early internal testing. A researcher demonstrated access to conversations and tokens on pre-release virtual machines that Meta employees used to test Muse.
Singleton explained that an authentication check accepted a header—a field attached to a web request—from a local HTTPS proxy as proof that the request came from a trusted source. A system migration introduced a second proxy layer, allowing outside requests to carry that trusted header too.
Meta took the service offline, corrected the flaw and stopped treating the local machine as trusted.
Malicious pages, passcodes and app credentials
A separate $90,000 report showed how a malicious web page could imitate status messages from Muse’s browsing tool when the agent was asked to summarize it. This was a prompt injection attack: page content tried to steer the agent’s behavior. Singleton said it caused Muse to perform actions that should have been caught.
Meta added detection signals and changed how Muse handles suspicious tool output. The company says its classifiers now catch that attack and 100 variants in testing.
Another researcher earned $90,000 for showing that particular formatting could bypass Muse’s email redaction filters for one-time passcodes. Meta described the bypass as one component of an end-to-end attack.
An Android flaw earned $50,000. A malicious app could pass a link to a privileged web view, an embedded browser with access to app credentials. The link handler recognized a shared-page path without checking the host, allowing an attacker-controlled page to load and capture those credentials.
A Mac app finding earned $1,000. It required an attacker to have access to the computer, from which they could hijack the auto-update feature and execute code with the app’s permissions.
For researchers assessing Muse, Meta offers up to $300,000 per valid report, a ceiling it claims is several times higher than the top rewards advertised by other leading AI developers. Prompt injection affecting one user can earn up to $130,000; a compromise across the fleet can earn up to $250,000.
